WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product workload manager✕
Overview 8 matches · 6 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
8matches 6in Waratek scope75.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC25.0% 2EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 25.0% No exploit published 4 50.0% Outside Waratek scope 1 12.5% Not applicable 1 12.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 5 62.5% Medium 2 25.0% Low 1 12.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 12.5% Proof of concept only 1 12.5% Forecast only 1 12.5% No public exploit 5 62.5%
split by peak 6 / year
Not applicable: 1Outside Waratek scope: 1No exploit published: 4Mitigation candidate: 2 Low: 1Medium: 2High: 5 not blocked: 8 No public exploit: 5Forecast only: 1Proof of concept only: 1Working exploit published: 1
20041 Not applicable1 Low1 not blocked1 No public exploit1 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20191 No exploit published1 High1 not blocked1 No public exploit1 20206 Mitigation candidate2 No exploit published3 Outside Waratek scope1 High4 Medium2 not blocked6 Working exploit published1 Proof of concept only1 Forecast only1 No public exploit3
200420062008201020122014201620182020
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-17527 High 2020-12-03 No exploit published No public exploit While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2020-13934 High 2020-07-14 No exploit published Forecast only An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
CVE-2020-11996 High 2020-06-26 Mitigation candidate Proof of concept only A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVE-2020-1935 Medium 2020-02-24 No exploit published No public exploit In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVE-2019-17569 Medium 2020-02-24 Outside Waratek scope No public exploit The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVE-2019-12418 High 2019-12-23 No exploit published No public exploit When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
CVE-2004-1713 Low 2004-08-10 Not applicable No public exploit Unknown vulnerability in HP Process Resource Manager (PRM) C.02.01[.01] and earlier, as used by HP-UX Workload Manager (WLM), allows local users to corrupt data files.